@webpresso/agent-kit 3.2.0 → 3.3.0

package/dist/esm/blueprint/lifecycle/review-provenance.js

@@ -3,7 +3,7 @@ import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { readReviewAuthorityAtRef, readWorkingReviewEvents } from "#review/authority.js";
 import { evaluateReviewEvents, parseReviewEventLog } from "#review/events.js";
-import { createDeliverySubjectAtRef, createPlanSubjectDigestForContent, normalizePlanSubjectContent, } from "#review/subject.js";
+import { createDeliverySubjectAtRef, createLegacyPlanSubjectDigestForContent, createPlanSubjectDigestForContent, createPreTagsStripPlanSubjectDigestForContent, normalizePlanSubjectContent, } from "#review/subject.js";
 import { isPolicyApprovalVerdict } from "#review/verdict.js";
 const REVIEW_ENTRY_MARKER = "<!-- wp:review-entry ";
 function normalizePath(file) {
@@ -44,7 +44,12 @@ function findGitRoot(file) {
         current = parent;
     }
 }
-function stableSlugForBlueprintFile(file) {
+/**
+ * Slug for a blueprint file, invariant across lifecycle moves
+ * (`draft/ → planned/ → completed/`) and across both the folder
+ * (`<slug>/_overview.md`) and legacy flat (`<slug>.md`) shapes.
+ */
+export function stableSlugForBlueprintFile(file) {
     const segments = normalizePath(file).split("/");
     const lifecycleIndex = segments.findIndex((segment) => new Set(["draft", "planned", "parked", "in-progress", "completed", "archived"]).has(segment));
     if (lifecycleIndex >= 0 && segments.at(-1) === "_overview.md") {
@@ -149,18 +154,42 @@ function collectWorkingV2ReviewProvenance(file, purpose, issues) {
         if (working.events.length === 0)
             return [];
         issues?.push(...working.issues);
+        // Events whose recorded `reviewedCommit` no longer resolves (typically
+        // orphaned by a rebase). Collected here rather than mutating
+        // `working.compromisedIds`, which is a ReadonlySet by contract, then merged
+        // into the set handed to evaluateReviewEvents below.
+        const unresolvableEventIds = new Set();
         const subjects = purpose === "plan"
             ? [
-                {
-                    scheme: "wp-blueprint-v1",
-                    digest: createPlanSubjectDigestForContent(slug, readFileSync(file)),
-                },
+                ...new Map([
+                    createPlanSubjectDigestForContent(slug, readFileSync(file)),
+                    createPreTagsStripPlanSubjectDigestForContent(slug, readFileSync(file)),
+                    createLegacyPlanSubjectDigestForContent(slug, readFileSync(file)),
+                ].map((digest) => [digest, { scheme: "wp-blueprint-v1", digest }])).values(),
             ]
             : [
                 ...new Map(working.events
                     .filter((event) => event.purpose === "delivery")
                     .flatMap((event) => {
-                    const subject = createDeliverySubjectAtRef(repoRoot, event.reviewedCommit, slug, normalizePath(path.relative(repoRoot, file)));
+                    // Scope subject-construction failure to THIS event. A rebase
+                    // rewrites commit SHAs, so a previously-recorded
+                    // `reviewedCommit` can become unresolvable; letting that throw
+                    // would escape to the outer catch and discard every approval,
+                    // including valid ones for commits that still resolve. Mirror
+                    // the ref-path's markCompromisedArtifactEvents: record the
+                    // issue, mark the event compromised, and drop only it.
+                    let subject;
+                    try {
+                        subject = createDeliverySubjectAtRef(repoRoot, event.reviewedCommit, slug, normalizePath(path.relative(repoRoot, file)));
+                    }
+                    catch (error) {
+                        issues?.push(`Working delivery review subject unavailable for ${event.id} at ${event.reviewedCommit}: ${error instanceof Error ? error.message : String(error)}`);
+                        // Compromised (not merely skipped) so the event can never
+                        // grant approval while still participating in reviewer
+                        // supersession — see evaluateReviewEvents.
+                        unresolvableEventIds.add(event.id);
+                        return [];
+                    }
                     if (subject.digest !== event.subjectDigest) {
                         issues?.push(`Working delivery review subject mismatch for ${event.id}: expected ${subject.digest}, found ${event.subjectDigest}.`);
                         return [];
@@ -174,7 +203,9 @@ function collectWorkingV2ReviewProvenance(file, purpose, issues) {
             blueprintSlug: slug,
             subjectScheme: subject.scheme,
             subjectDigest: subject.digest,
-        }, working.compromisedIds).approvals)
+        }, unresolvableEventIds.size === 0
+            ? working.compromisedIds
+            : new Set([...working.compromisedIds, ...unresolvableEventIds])).approvals)
             .filter((event) => event.artifactPath)
             .map((event) => ({
             reviewer: event.reviewer,

package/dist/esm/blueprint/lifecycle/rollout-anchor.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Rollout grandfathering, decided from git history instead of frontmatter.
+ *
+ * Two gates used to grant themselves an exemption by reading a blueprint's own
+ * `created:` frontmatter and comparing it to a hardcoded rollout date. That
+ * value is written by the same author the gate is meant to constrain, so
+ * `created: "2020-01-01"` disabled the check outright — on the CI audit path and
+ * (for the approval gate) on the `assertCompletedApprovalGate` write path, which
+ * would let a blueprint reach `completed` carrying no approval at all.
+ *
+ * Presence in a fixed commit's tree is instead a structural fact about history:
+ * no file content can add a slug to a tree that was written months ago.
+ *
+ * Matching on **slug** rather than path is deliberate. Blueprints legitimately
+ * move `draft/ → planned/ → completed/`, so a path-based check would mistake a
+ * lifecycle move for a new blueprint, while `git log --follow` would introduce a
+ * rename-similarity heuristic. The slug is invariant across those moves — the
+ * repo already enforces one blueprint = one slug = one `bp/<slug>` branch.
+ */
+/**
+ * The commit that introduced both the completed-approval gate and the Trust
+ * Dossier requirement ("fix: preserve pre-contract blueprint rollouts",
+ * 2026-07-12). Blueprints already tracked at this commit predate both contracts.
+ */
+export declare const ROLLOUT_ANCHOR_COMMIT = "c6ccb5f31cbecde3be4dbd6d3b7e67918006d22e";
+/** The date that anchor landed, used only by the legacy fallback below. */
+export declare const ROLLOUT_DATE = "2026-07-12";
+/**
+ * Outcome of consulting the anchor, cached per (repoRoot, anchorCommit).
+ *
+ * - `not-applicable`: the anchor commit is not in this repository at all. The
+ *   rollout it marks is an agent-kit history event, so in a consumer repo (which
+ *   has its own unrelated history) the "predates the rollout" question is
+ *   vacuous. Those repos keep their prior behaviour: nothing is retroactively
+ *   gated. The security property is unaffected where it matters, because in
+ *   agent-kit the anchor is an ancestor of `main`. Note a shallow clone can
+ *   also lack it; that case is detected separately and fails closed rather
+ *   than falling back, so truncated history cannot reopen the bypass.
+ * - `slugs`: the anchor resolved; membership decides the exemption.
+ * - `unreadable`: the anchor exists but could not be listed, OR it is absent
+ *   from a shallow clone where truncated history could be hiding it. Both are
+ *   inconclusive rather than different-repo signals, so both fail **closed**.
+ *   Memoised for the process lifetime, so a transient git failure stays
+ *   fail-closed for the rest of the run -- acceptable for short-lived CLI and
+ *   audit processes, and the safe direction if it ever is not.
+ */
+type AnchorLookup = {
+    readonly kind: "not-applicable";
+} | {
+    readonly kind: "slugs";
+    readonly slugs: ReadonlySet<string>;
+} | {
+    readonly kind: "unreadable";
+};
+/**
+ * Slugs tracked under `blueprints/` at `anchorCommit`, or `null` when the anchor
+ * cannot be read. Memoised per (repoRoot, anchorCommit).
+ *
+ * Callers must treat `null` as "grandfather nobody" — see
+ * {@link isBlueprintExemptFromRollout}, which fails closed.
+ */
+export declare function blueprintSlugsAtRolloutAnchor(repoRoot: string, anchorCommit?: string): AnchorLookup;
+/**
+ * True when this blueprint is exempt from a rollout-gated contract.
+ *
+ * Resolution order, deliberately:
+ *
+ * 1. **Anchor is present in this repository** (the agent-kit repo, where these
+ *    contracts actually rolled out and where CI and the promote/finalize write
+ *    path enforce them): membership in the anchor tree decides, and the
+ *    author-supplied `created` is ignored entirely. This is what closes the
+ *    forgery — a blueprint cannot add its own slug to a months-old tree.
+ * 2. **Anchor absent from a full (non-shallow) clone, or no git repository at
+ *    all**: the rollout is an agent-kit history event that never happened here,
+ *    so the anchor cannot answer the question. Fall back to the previous
+ *    `created` compare. This is unchanged prior behaviour for consumer repos and
+ *    non-git contexts, which is deliberate: those contexts have no such
+ *    protection today, so tightening them is a separate decision, and gating
+ *    them here would be unsatisfiable anyway because every accepted form of
+ *    approval provenance is git-tracked.
+ * 3. **Inconclusive**: the anchor exists but cannot be listed, or it is absent
+ *    from a *shallow* clone where truncated history could be hiding it. Fails
+ *    **closed** — the gate applies. Without the shallow check, `git clone
+ *    --depth 1` of this very repository would drop to the forgeable date
+ *    fallback and reopen the bypass on the local promote/finalize write path.
+ *
+ * Net effect: strictly hardens the gate where it is enforced, and regresses
+ * nothing anywhere else.
+ */
+export declare function isBlueprintExemptFromRollout(input: {
+    readonly repoRoot: string | null | undefined;
+    readonly slug: string;
+    readonly created: unknown;
+    readonly rolloutDate: string;
+    readonly anchorCommit?: string;
+}): boolean;
+export {};

package/dist/esm/blueprint/lifecycle/rollout-anchor.js

@@ -0,0 +1,161 @@
+import { execFileSync } from "node:child_process";
+/**
+ * Rollout grandfathering, decided from git history instead of frontmatter.
+ *
+ * Two gates used to grant themselves an exemption by reading a blueprint's own
+ * `created:` frontmatter and comparing it to a hardcoded rollout date. That
+ * value is written by the same author the gate is meant to constrain, so
+ * `created: "2020-01-01"` disabled the check outright — on the CI audit path and
+ * (for the approval gate) on the `assertCompletedApprovalGate` write path, which
+ * would let a blueprint reach `completed` carrying no approval at all.
+ *
+ * Presence in a fixed commit's tree is instead a structural fact about history:
+ * no file content can add a slug to a tree that was written months ago.
+ *
+ * Matching on **slug** rather than path is deliberate. Blueprints legitimately
+ * move `draft/ → planned/ → completed/`, so a path-based check would mistake a
+ * lifecycle move for a new blueprint, while `git log --follow` would introduce a
+ * rename-similarity heuristic. The slug is invariant across those moves — the
+ * repo already enforces one blueprint = one slug = one `bp/<slug>` branch.
+ */
+/**
+ * The commit that introduced both the completed-approval gate and the Trust
+ * Dossier requirement ("fix: preserve pre-contract blueprint rollouts",
+ * 2026-07-12). Blueprints already tracked at this commit predate both contracts.
+ */
+export const ROLLOUT_ANCHOR_COMMIT = "c6ccb5f31cbecde3be4dbd6d3b7e67918006d22e";
+/** The date that anchor landed, used only by the legacy fallback below. */
+export const ROLLOUT_DATE = "2026-07-12";
+const anchorSlugCache = new Map();
+function anchorCommitExists(repoRoot, anchorCommit) {
+    try {
+        execFileSync("git", ["cat-file", "-e", `${anchorCommit}^{commit}`], {
+            cwd: repoRoot,
+            stdio: ["ignore", "ignore", "ignore"],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * A shallow clone (`git clone --depth 1`) can be missing the anchor purely
+ * because history was truncated, which is indistinguishable from "different
+ * repository" by anchor lookup alone. Detecting shallowness lets us tell the two
+ * apart instead of assuming the benign one.
+ */
+function isShallowRepository(repoRoot) {
+    try {
+        const out = execFileSync("git", ["rev-parse", "--is-shallow-repository"], {
+            cwd: repoRoot,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        // A path that is not a git repository at all answers with a non-zero exit,
+        // handled below. Anything else that is not a clean "false" is treated as
+        // truncated, so an odd repository shape fails closed rather than falling
+        // back to the forgeable date.
+        return out.trim() !== "false";
+    }
+    catch {
+        // Not a git repository (or git is unusable here). This is the "no history to
+        // consult" case, not a truncated-history case: the caller falls back, which
+        // preserves prior behaviour for non-git contexts where the gate would be
+        // unsatisfiable anyway.
+        return false;
+    }
+}
+/**
+ * Slugs tracked under `blueprints/` at `anchorCommit`, or `null` when the anchor
+ * cannot be read. Memoised per (repoRoot, anchorCommit).
+ *
+ * Callers must treat `null` as "grandfather nobody" — see
+ * {@link isBlueprintExemptFromRollout}, which fails closed.
+ */
+export function blueprintSlugsAtRolloutAnchor(repoRoot, anchorCommit = ROLLOUT_ANCHOR_COMMIT) {
+    const cacheKey = `${anchorCommit}:${repoRoot}`;
+    const cached = anchorSlugCache.get(cacheKey);
+    if (cached !== undefined)
+        return cached;
+    const result = (() => {
+        if (!anchorCommitExists(repoRoot, anchorCommit)) {
+            // Absent because this is a different repository (fine -- the rollout never
+            // happened here) or because history was truncated (NOT fine -- that would
+            // silently reopen the forged-date bypass). Only the former may fall back.
+            return isShallowRepository(repoRoot) ? { kind: "unreadable" } : { kind: "not-applicable" };
+        }
+        try {
+            const stdout = execFileSync("git", ["ls-tree", "-r", "--name-only", anchorCommit, "blueprints/"], { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+            const found = new Set();
+            for (const line of stdout.split("\n")) {
+                const match = /^blueprints\/[^/]+\/(.+)$/u.exec(line.trim());
+                if (!match)
+                    continue;
+                const rest = match[1] ?? "";
+                // Folder shape `<slug>/_overview.md`, or legacy flat `<slug>.md`.
+                const slug = rest.includes("/")
+                    ? rest.slice(0, rest.indexOf("/"))
+                    : rest.endsWith(".md")
+                        ? rest.slice(0, -3)
+                        : "";
+                if (slug)
+                    found.add(slug);
+            }
+            return { kind: "slugs", slugs: found };
+        }
+        catch {
+            return { kind: "unreadable" };
+        }
+    })();
+    anchorSlugCache.set(cacheKey, result);
+    return result;
+}
+/** Legacy fallback: the author-supplied `created` date compare. */
+function createdPredatesRollout(created, rolloutDate) {
+    const date = created instanceof Date
+        ? created.toISOString().slice(0, 10)
+        : typeof created === "string" && /^\d{4}-\d{2}-\d{2}$/u.test(created)
+            ? created
+            : null;
+    return date !== null && date < rolloutDate;
+}
+/**
+ * True when this blueprint is exempt from a rollout-gated contract.
+ *
+ * Resolution order, deliberately:
+ *
+ * 1. **Anchor is present in this repository** (the agent-kit repo, where these
+ *    contracts actually rolled out and where CI and the promote/finalize write
+ *    path enforce them): membership in the anchor tree decides, and the
+ *    author-supplied `created` is ignored entirely. This is what closes the
+ *    forgery — a blueprint cannot add its own slug to a months-old tree.
+ * 2. **Anchor absent from a full (non-shallow) clone, or no git repository at
+ *    all**: the rollout is an agent-kit history event that never happened here,
+ *    so the anchor cannot answer the question. Fall back to the previous
+ *    `created` compare. This is unchanged prior behaviour for consumer repos and
+ *    non-git contexts, which is deliberate: those contexts have no such
+ *    protection today, so tightening them is a separate decision, and gating
+ *    them here would be unsatisfiable anyway because every accepted form of
+ *    approval provenance is git-tracked.
+ * 3. **Inconclusive**: the anchor exists but cannot be listed, or it is absent
+ *    from a *shallow* clone where truncated history could be hiding it. Fails
+ *    **closed** — the gate applies. Without the shallow check, `git clone
+ *    --depth 1` of this very repository would drop to the forgeable date
+ *    fallback and reopen the bypass on the local promote/finalize write path.
+ *
+ * Net effect: strictly hardens the gate where it is enforced, and regresses
+ * nothing anywhere else.
+ */
+export function isBlueprintExemptFromRollout(input) {
+    const { repoRoot, slug, created, rolloutDate } = input;
+    const anchorCommit = input.anchorCommit ?? ROLLOUT_ANCHOR_COMMIT;
+    if (repoRoot) {
+        const lookup = blueprintSlugsAtRolloutAnchor(repoRoot, anchorCommit);
+        if (lookup.kind === "slugs")
+            return slug.length > 0 && lookup.slugs.has(slug);
+        if (lookup.kind === "unreadable")
+            return false;
+    }
+    return createdPredatesRollout(created, rolloutDate);
+}

package/dist/esm/blueprint/sync/client.d.ts

@@ -5,6 +5,7 @@
  * platform requests share the strict origin, redirect, body, redaction, abort,
  * and retry boundary in src/platform/client.ts.
  */
+import { type FetchLike } from "#platform/client.js";
 import type { SyncCredentials } from "./auth.js";
 import type { BlueprintPlatformClient, BlueprintPlatformEvent, BlueprintSnapshot, BlueprintTemplateEntry } from "./types.js";
 export declare class AuthError extends Error {
@@ -22,7 +23,7 @@ export declare class BlueprintSyncClient implements BlueprintPlatformClient {
     private readonly fetchFn;
     private platformClient;
     private readonly retry;
-    constructor(creds: SyncCredentials, fetchFn?: typeof globalThis.fetch, retryOptions?: RetryOptions);
+    constructor(creds: SyncCredentials, fetchFn?: FetchLike, retryOptions?: RetryOptions);
     pushEvent(payload: BlueprintPlatformEvent): Promise<void>;
     getSnapshot(opts?: {
         readonly slug?: string;

package/dist/esm/blueprint/sync/client.js

@@ -6,7 +6,7 @@
  * and retry boundary in src/platform/client.ts.
  */
 import { randomUUID } from "node:crypto";
-import { PlatformClient, PlatformHttpError } from "#platform/client.js";
+import { PlatformClient, PlatformHttpError, } from "#platform/client.js";
 export class AuthError extends Error {
     constructor(message) {
         super(message);

package/dist/esm/blueprint/trust/dossier.d.ts

@@ -22,6 +22,7 @@ export type TrustPromotionGate = {
     command: string;
     expectedOutcome: string;
     lastResult: string;
+    defer: string;
 };
 export type TrustDossier = {
     readiness: TrustReadinessVerdict;

package/dist/esm/blueprint/trust/dossier.js

@@ -36,12 +36,7 @@ export function parseTrustDossier(markdown) {
         rejectedAlternatives,
         rationale,
     }), violations);
-    const gates = parseTable(requiredBlock(blocks, "Promotion Gates"), "Promotion Gates", ["Gate", "Command", "Expected outcome", "Last result"], ([gate = "", command = "", expectedOutcome = "", lastResult = ""]) => ({
-        gate,
-        command,
-        expectedOutcome,
-        lastResult,
-    }), violations);
+    const gates = parsePromotionGatesTable(requiredBlock(blocks, "Promotion Gates"), violations);
     const residualUnknowns = requiredBlock(blocks, "Residual Unknowns").trim();
     for (const [section, block] of blocks) {
         if (containsPlaceholder(block))
@@ -126,6 +121,45 @@ function parseTable(block, section, expectedHeader, build, violations) {
     }
     return result;
 }
+const PROMOTION_GATES_HEADER_LEGACY = ["Gate", "Command", "Expected outcome", "Last result"];
+const PROMOTION_GATES_HEADER_WITH_DEFER = [...PROMOTION_GATES_HEADER_LEGACY, "Defer"];
+// Bespoke (not parseTable()) so the header/row width can be EITHER the
+// legacy 4-column shape (every Promotion Gates table committed before this
+// fix, and the common case going forward) OR the 5-column shape with a
+// trailing Defer column (opt-in, see TrustPromotionGate.defer). A committed
+// blueprint's table must have every row match its own header's width -- a
+// row can't silently be short one cell.
+function parsePromotionGatesTable(block, violations) {
+    const section = "Promotion Gates";
+    const rows = block
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith("|") && line.endsWith("|"));
+    if (rows.length < 2) {
+        violations.push({ section, message: "missing markdown table" });
+        return [];
+    }
+    const header = splitRow(rows[0] ?? "").map((cell) => cell.toLowerCase());
+    const legacyHeader = PROMOTION_GATES_HEADER_LEGACY.map((cell) => cell.toLowerCase());
+    const deferHeader = PROMOTION_GATES_HEADER_WITH_DEFER.map((cell) => cell.toLowerCase());
+    const hasDeferColumn = header.join("|") === deferHeader.join("|");
+    if (!hasDeferColumn && header.join("|") !== legacyHeader.join("|")) {
+        violations.push({ section, message: `malformed table header for ${section}` });
+        return [];
+    }
+    const expectedWidth = hasDeferColumn ? 5 : 4;
+    const result = [];
+    for (const row of rows.slice(2)) {
+        const cells = splitRow(row);
+        if (cells.length !== expectedWidth) {
+            violations.push({ section, message: `malformed table row in ${section}` });
+            continue;
+        }
+        const [gate = "", command = "", expectedOutcome = "", lastResult = "", defer = ""] = cells;
+        result.push({ gate, command, expectedOutcome, lastResult, defer });
+    }
+    return result;
+}
 function requiredBlock(blocks, key) {
     const value = blocks.get(key);
     if (value === undefined)

package/dist/esm/blueprint/trust/promotion.js

@@ -28,6 +28,15 @@ export function preparePromotionTrustGate(input) {
         throw new Error(`Blueprint trust gate failed: ${preflight.violations.map((v) => `${v.section}: ${v.message}`).join("; ")}`);
     const parsed = parseTrustDossier(markdown);
     for (const gate of parsed.dossier?.gates ?? []) {
+        if (gate.defer === "pre-implementation") {
+            // Explicit opt-in deferral (Trust Dossier "Defer" column): the gate's
+            // command is never executed nor existence-checked at promote time. This
+            // is deliberately narrower than the automatic `wp test --file` deferral
+            // below -- it only applies when a human/agent explicitly asked for it,
+            // so a genuinely broken/mistyped gate command still fails closed.
+            markdown = updateGateLastResult(markdown, gate.gate, "deferred: pre-implementation (explicit defer marker)");
+            continue;
+        }
         const deferredTarget = firstMissingTestTarget(input.repoRoot, gate.command);
         if (deferredTarget !== undefined) {
             // A `wp test --file <path>` gate whose target file does not exist yet is
@@ -156,6 +165,9 @@ function updateGateLastResult(markdown, gate, result) {
         if (cells[0] === gate && cells.length === 4) {
             lines[i] = `| ${cells[0]} | ${cells[1]} | ${cells[2]} | ${result} |`;
         }
+        else if (cells[0] === gate && cells.length === 5) {
+            lines[i] = `| ${cells[0]} | ${cells[1]} | ${cells[2]} | ${result} | ${cells[4]} |`;
+        }
     }
     return lines.join("\n");
 }

package/dist/esm/build/cli-mcp-parity.js

@@ -208,6 +208,11 @@ export const CLI_MCP_PARITY_CLASSIFICATION = {
         tools: ["wp_lint"],
         reason: "lint MCP tool exists",
     },
+    "rust-check": {
+        command: "rust-check",
+        classification: "follow-up-candidate",
+        reason: "cargo check/test verb for the ci-preflight Rust lane; CLI-only dev gate with no dedicated MCP tool",
+    },
     logs: {
         command: "logs",
         classification: "follow-up-candidate",

package/dist/esm/cli/cli.d.ts

@@ -5,7 +5,7 @@
  * Lazy-loads subcommand modules based on the first argv to keep startup
  * cheap. Modeled on apps/cli-wp/src/cli.ts.
  */
-declare const SUPPORTED_COMMANDS: readonly ["blueprint", "browser", "dash", "dash-helper-start", "dash-helper-complete", "claude", "codex", "grok", "opencode", "yolo", "config", "secrets", "roadmap", "status", "review", "sync", "audit", "qa", "ultragoal", "compile", "rule", "skill", "skills", "docs", "setup", "init", "dev", "deploy", "preview", "cleanup", "migrate", "doctor", "err", "test", "e2e", "ci", "ci-preflight", "public:readiness", "typecheck", "lint", "format", "logs", "session-id", "session-info", "session", "tech-debt", "pr", "fleet", "worktree", "mcp", "hook", "hooks", "self-install-guard", "optional-tool-refresh", "gain", "bench", "install", "add", "remove", "update", "exec", "run"];
+declare const SUPPORTED_COMMANDS: readonly ["blueprint", "browser", "dash", "dash-helper-start", "dash-helper-complete", "claude", "codex", "grok", "opencode", "yolo", "config", "secrets", "roadmap", "status", "review", "sync", "audit", "qa", "ultragoal", "compile", "rule", "skill", "skills", "docs", "setup", "init", "dev", "deploy", "preview", "cleanup", "migrate", "doctor", "err", "test", "e2e", "ci", "ci-preflight", "public:readiness", "typecheck", "lint", "format", "rust-check", "logs", "session-id", "session-info", "session", "tech-debt", "pr", "fleet", "worktree", "mcp", "hook", "hooks", "self-install-guard", "optional-tool-refresh", "gain", "bench", "install", "add", "remove", "update", "exec", "run"];
 export type SupportedCommand = (typeof SUPPORTED_COMMANDS)[number];
 type RootHelpEntry = {
     readonly command: string;

package/dist/esm/cli/cli.js

@@ -59,6 +59,7 @@ const SUPPORTED_COMMANDS = [
     "typecheck",
     "lint",
     "format",
+    "rust-check",
     "logs",
     "session-id",
     "session-info",
@@ -103,6 +104,10 @@ const ROOT_HELP_CORE_ENTRIES = [
         command: "format",
         description: "Format through the portable wp surface (--check for CI/husky)",
     },
+    {
+        command: "rust-check",
+        description: "Prove affected tracked Rust crates compile and pass tests (cargo check + test)",
+    },
     {
         command: "e2e",
         description: "Build and run E2E commands through the portable webpresso surface",
@@ -386,6 +391,10 @@ const COMMAND_REGISTRARS = {
         const { registerFormatCommand } = await import("./commands/format.js");
         registerFormatCommand(cli);
     },
+    "rust-check": async (cli) => {
+        const { registerRustCheckCommand } = await import("./commands/rust-check.js");
+        registerRustCheckCommand(cli);
+    },
     logs: async (cli) => {
         const { registerLogsCommand } = await import("./commands/logs.js");
         registerLogsCommand(cli);

package/dist/esm/cli/commands/agent-launch.d.ts

@@ -3,6 +3,7 @@ import { type DashPermissionMode, type DashProvider } from "#cli/commands/dash/p
 import { type RuntimeCommandOptions } from "#runtime/executor.js";
 import { type SecretsConfig } from "#runtime/secrets-config.js";
 import { resolveOpencodeAccountsGracefully } from "#runtime/opencode-account-materializer.js";
+import { resolveHealthyOpencodeAccount } from "#cli/commands/opencode-probe.js";
 export declare const AGENT_LAUNCH_COMMANDS: readonly ["claude", "codex", "grok", "opencode"];
 export type AgentLaunchCommand = DashProvider;
 export declare const DEFAULT_AGENT_SECRET_PROFILE = "preview";
@@ -23,6 +24,7 @@ export interface AgentLaunchDeps {
     readonly materializeGlobalOpencodeAuth?: (key: string) => void;
     readonly readActiveKey?: () => string | undefined;
     readonly recordCooldown?: (canonicalId: string) => Promise<unknown>;
+    readonly resolveHealthyOpencodeAccount?: typeof resolveHealthyOpencodeAccount;
 }
 export declare function buildDefaultAgentArgs(command: AgentLaunchCommand, args?: readonly string[], permissionMode?: DashPermissionMode): readonly string[];
 export declare function isAgentLaunchCommand(command: string | undefined): command is AgentLaunchCommand;

package/dist/esm/cli/commands/agent-launch.js

@@ -12,6 +12,7 @@ import { loadOpencodeAccountAvailability, pruneExpiredOpencodeAccountSuppression
 import { selectActiveOpencodeAccount } from "#review/opencode-account.js";
 import { materializeOpencodeGoAuth } from "#review/opencode-auth.js";
 import { describeOpencodeRotate, OPENCODE_ROTATE_FLAG, rotateActiveOpencodeAccount, } from "#cli/commands/opencode-rotate.js";
+import { OPENCODE_SKIP_PROBE_ENV, resolveHealthyOpencodeAccount, } from "#cli/commands/opencode-probe.js";
 export const AGENT_LAUNCH_COMMANDS = DASH_PROVIDERS;
 export const DEFAULT_AGENT_SECRET_PROFILE = "preview";
 export const AGENT_SECRET_PROFILE_ENV = "WP_AGENT_SECRET_PROFILE";
@@ -89,21 +90,26 @@ function ensureCodexSkillSurface(cwd, env = process.env) {
     }
 }
 /**
- * Choose the active opencode-go account and materialize its key into the
- * global opencode `auth.json` before the TUI launches.
+ * Choose the active opencode-go account, verify it against the real provider,
+ * and materialize its key into the global opencode `auth.json` before the TUI
+ * launches.
+ *
+ * A launch-time health probe (`resolveHealthyOpencodeAccount`) spawns a bounded
+ * `opencode run` against the candidate's isolated credential store; a detected
+ * usage limit cools that account with the provider's real reset window and the
+ * next account is probed instead. So a plain relaunch now *does* rotate past an
+ * exhausted account, and `wp opencode --wp-rotate` is only needed to force a
+ * swap off an account that is still answering.
  *
  * Honest limitation: interactive opencode is a long-lived TUI — the account is
- * chosen once at launch and a mid-session dollar-cap is NOT auto-swapped. A
- * plain relaunch does NOT rotate either: nothing on this path records a
- * cooldown, so an exhausted account stays "first non-suppressed" and gets
- * re-picked every time. Run `wp opencode --wp-rotate` to cool the current
- * account and launch on the next one. Only the review gate does automatic
- * in-flight failover, because only it can observe the usage-limit response.
+ * chosen once at launch, so a cap hit *mid-session* is still NOT auto-swapped.
+ * Only the review gate does in-flight failover, because only it observes every
+ * provider response for the life of the run.
  *
- * Never throws: a Doppler outage or materialize failure must not block the
- * TUI from launching, so every failure is logged and swallowed.
+ * Never throws: a Doppler outage, a failed probe, or a materialize failure must
+ * not block the TUI from launching, so every failure is logged and swallowed.
  */
-function selectAndMaterializeOpencodeAccount(cwd, deps, secretProfile) {
+async function selectAndMaterializeOpencodeAccount(cwd, deps, secretProfile, env) {
     try {
         const resolution = (deps.resolveOpencodeAccounts ?? resolveOpencodeAccountsGracefully)({
             cwd,
@@ -112,11 +118,15 @@ function selectAndMaterializeOpencodeAccount(cwd, deps, secretProfile) {
         if (!resolution.ok)
             return;
         const pruned = pruneExpiredOpencodeAccountSuppressions(loadOpencodeAccountAvailability());
-        const selection = selectActiveOpencodeAccount(resolution.accounts, pruned.state);
-        if (!selection)
+        const initial = selectActiveOpencodeAccount(resolution.accounts, pruned.state);
+        if (!initial)
             return;
+        const probed = await (deps.resolveHealthyOpencodeAccount ?? resolveHealthyOpencodeAccount)(resolution.accounts, initial, { env });
+        for (const line of probed.lines)
+            console.error(line);
+        const selection = probed.selection;
         (deps.materializeGlobalOpencodeAuth ?? ((key) => materializeOpencodeGoAuth(key)))(selection.account.key);
-        if (selection.cooled) {
+        if (selection.cooled && probed.lines.length === 0) {
             console.error(`wp opencode: all OpenCode Go accounts are within their usage cooldown; launching on the soonest-expiring account (${selection.account.id}).`);
         }
     }
@@ -130,10 +140,11 @@ function selectAndMaterializeOpencodeAccount(cwd, deps, secretProfile) {
  * forward to the binary. `--wp-rotate` is consumed here and must never reach
  * opencode, which would treat it as a prompt.
  */
-async function prepareOpencodeLaunch(cwd, args, secretsConfig, deps, secretProfile) {
+async function prepareOpencodeLaunch(cwd, args, secretsConfig, deps, secretProfile, env) {
     if (!args.includes(OPENCODE_ROTATE_FLAG)) {
-        if (secretsConfig !== null)
-            selectAndMaterializeOpencodeAccount(cwd, deps, secretProfile);
+        if (secretsConfig !== null) {
+            await selectAndMaterializeOpencodeAccount(cwd, deps, secretProfile, env);
+        }
         return args;
     }
     const outcome = await rotateActiveOpencodeAccount(cwd, secretProfile, deps);
@@ -144,7 +155,7 @@ async function prepareOpencodeLaunch(cwd, args, secretsConfig, deps, secretProfi
     // rotation could not run, fall through to that selection so the launch still
     // gets the best account it can rather than whatever the store happens to hold.
     if (outcome.kind === "unavailable" && secretsConfig !== null) {
-        selectAndMaterializeOpencodeAccount(cwd, deps, secretProfile);
+        await selectAndMaterializeOpencodeAccount(cwd, deps, secretProfile, env);
     }
     return args.filter((arg) => arg !== OPENCODE_ROTATE_FLAG);
 }
@@ -166,7 +177,7 @@ export async function runAgentLaunchCommand(command, args = [], options = {}, de
     // worktree, CI clone, and fresh checkout.
     const secretProfile = resolveAgentSecretProfile(options.env ?? process.env);
     const launchArgs = command === "opencode"
-        ? await prepareOpencodeLaunch(cwd, args, secretsConfig, deps, secretProfile)
+        ? await prepareOpencodeLaunch(cwd, args, secretsConfig, deps, secretProfile, options.env ?? process.env)
         : args;
     const runtimeOptions = buildAgentRuntimeCommandOptions({
         command,
@@ -184,7 +195,7 @@ export async function runAgentLaunchCommand(command, args = [], options = {}, de
 }
 export function registerAgentLaunchCommand(cli, command) {
     const rotateHint = command === "opencode"
-        ? ` (pass \`${OPENCODE_ROTATE_FLAG}\` to cool the current OpenCode Go account and launch on the next one)`
+        ? ` (the selected OpenCode Go account is health-probed first and a capped one is rotated past automatically; pass \`${OPENCODE_ROTATE_FLAG}\` to force a rotation, or set \`${OPENCODE_SKIP_PROBE_ENV}=1\` to skip the probe)`
         : "";
     cli
         .command(`${command} [...args]`, `Launch ${command} with provider-backed agent secrets and safe-by-default permissions (run \`wp yolo on\` for persistent full-auto)${rotateHint}`)